search

libyal / libbde

Library and tools to access the BitLocker Drive Encryption (BDE) encrypted volumes
GNU Lesser General Public License v3.0
214 stars 52 forks source link

How to decrypt the VMK by using BitLocker Recovery Key? #65

Closed MaxFuwin closed 1 year ago

MaxFuwin commented 1 year ago

Hello Joachim, I have read the documentation but the problem is I was using a lib called AES from Cryptodome in Python decrypting the VMK which means when I keyed in “iv = 0”in python and it said that the length of initial vector must be 7-12 bytes, so I wasn’t sure about the length because if I keyed in the wrong length of initial vector and I will get the wrong VMK and I had the Recovery Key and the VMK which is encrypted by the BitLocker Recovery Key. But I didn't know how to use the BitLocker Recovery Key to decrypt the whole VMK

joachimmetz commented 1 year ago

I don't have sufficient details to answer your question. What is known, is documented and in the code.

when I keyed in “iv = 0”in python and it said that the length of initial vector must be 7-12 bytes

iv = 0 refers to a byte array of 0-byte values of a size specific to the AES-CCM implementation used for BitLocker

joachimmetz commented 1 year ago

Marking as duplicate of https://github.com/libyal/libbde/issues/64

MaxFuwin commented 1 year ago

Do you know how to decrypt the VMK by using BitLocker Recovery Key in libbde ?

joachimmetz commented 1 year ago

Do you know how to decrypt the VMK by using BitLocker Recovery Key in libbde ?

I don't understand this question? libbde can decrypt an encrypted volume

First of all there is no single VMK, the VMK is dependent on the data, how the VMK is protected is dependent on the key protectors used.

If you cannot be specific in your questions in about your specific situation, I cannot help you.